Every CVE Search/ Get API key

CVE-2026-54171

Excon: redact additional sensitive/risky headers when following redirects

6.5 MediumFix available

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.43%Unchanged since Jul 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

Excon: redact additional sensitive/risky headers when following redirects

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.

Record
CVE-2026-54171
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-201
Updated
2026-11-02
EUVDEUVD-2026-45312 6.5

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.

Record
EUVD-2026-45312
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-48rx-c7pg-q66r 6.5

Excon does not redact additional sensitive/risky headers when following redirects

Impact

The redirect follower middleware previously failed to strip a number of headers that are known to be sensitive and did not provide a way to provide a custom list of headers to strip.

What kind of vulnerability is it? Who is impacted? This could cause inadvertent leakage of sensitive data for users of the RedirectFollower middleware in cases where the initial request includes header information that is not intended for the new target.

Patches

Patch exists and is released in v1.5.0

Workarounds

Users can backport the fix to a custom redirect follower middleware.

Record
GHSA-48rx-c7pg-q66r
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-201, CWE-522
Updated
2026-11-02
NVD 6.5

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.

Record
CVE-2026-54171
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-201
Updated
2026-11-02
OSV 6.5

Excon: redact additional sensitive/risky headers when following redirects

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.

Record
CVE-2026-54171
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-201
Updated
2026-11-02
OSVDEBIAN-CVE-2026-54171 6.5

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.

Record
DEBIAN-CVE-2026-54171
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-48rx-c7pg-q66r 6.5

Excon does not redact additional sensitive/risky headers when following redirects

Impact

The redirect follower middleware previously failed to strip a number of headers that are known to be sensitive and did not provide a way to provide a custom list of headers to strip.

What kind of vulnerability is it? Who is impacted? This could cause inadvertent leakage of sensitive data for users of the RedirectFollower middleware in cases where the initial request includes header information that is not intended for the new target.

Patches

Patch exists and is released in v1.5.0

Workarounds

Users can backport the fix to a custom redirect follower middleware.

Record
GHSA-48rx-c7pg-q66r
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-201, CWE-522
Updated
2026-11-02
OSVOESA-2026-3100 6.5

rubygem-excon security update

EXtended http(s) CONnections.

Security Fix(es):

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.(CVE-2026-54171)

Record
OESA-2026-3100
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-54171 6.5

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.

Record
UBUNTU-CVE-2026-54171
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVAZL-92460 No score

CVE-2026-54171 affecting package rubygem-excon for versions less than 0.102.0-2

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.

Record
AZL-92460
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
excon
RubyGems
 before 1.5.0
1.5.0
rubygem-excon
Azure Linux:3
 before 0.102.0-2
0.102.0-2
ruby-excon
Debian:12
 All versions, plus listed versions
0.112.0-10.112.0-20.112.0-30.112.0-40.88.0-1
Show 10 moreShow less
1.3.1-11.3.2-11.3.2-21.4.0-11.4.0-21.4.2-11.5.0-11.6.0-11.7.0-11.7.1-1
 None known
ruby-excon
Debian:13
 All versions, plus listed versions
0.112.0-41.3.1-11.3.2-11.3.2-21.4.0-1
Show 6 moreShow less
1.4.0-21.4.2-11.5.0-11.6.0-11.7.0-11.7.1-1
 None known
ruby-excon
Debian:14
 before 1.5.0-1, plus listed versions
0.112.0-41.3.1-11.3.2-11.3.2-21.4.0-11.4.0-21.4.2-1
1.5.0-1
excon
RubyGems
 before 1.5.0, plus listed versions
0.0.10.0.100.0.110.0.120.0.13
Show 45 moreShow less
0.0.140.0.150.0.160.0.170.0.180.0.190.0.20.0.200.0.210.0.220.0.230.0.240.0.250.0.260.0.30.0.40.0.50.0.70.0.80.1.00.1.10.1.20.1.30.1.40.10.00.10.10.100.00.101.00.102.00.103.00.104.00.105.00.106.00.107.00.108.00.109.00.11.00.110.00.111.00.112.00.12.00.13.00.13.10.13.20.13.3
1.5.0
rubygem-excon
openEuler:20.03-LTS-SP4
 before 0.62.0-4.oe2003sp4
0.62.0-4.oe2003sp4
rubygem-excon
openEuler:22.03-LTS-SP4
 before 0.62.0-4.oe2203sp4
0.62.0-4.oe2203sp4
rubygem-excon
openEuler:24.03-LTS-SP1
 before 0.104.0-2.oe2403sp1
0.104.0-2.oe2403sp1
rubygem-excon
openEuler:24.03-LTS-SP3
 before 0.104.0-2.oe2403sp3
0.104.0-2.oe2403sp3
Show 8 moreShow less
Affected packages
PackageAffectedFixed
rubygem-excon
openEuler:24.03-LTS-SP4
 before 0.104.0-2.oe2403sp4
0.104.0-2.oe2403sp4
ruby-excon
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.45.1-2
 None known
ruby-excon
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.54.0-10.60.0-1
 None known
ruby-excon
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.60.0-10.60.0-20.72.0-2
 None known
ruby-excon
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.79.0-20.88.0-1
 None known
ruby-excon
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.88.0-1
 None known
ruby-excon
Ubuntu:26.10
 All versions, plus listed versions
1.3.2-11.4.2-11.5.0-11.6.0-1
 None known
ruby-excon
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.112.0-41.3.1-11.3.2-1
 None known

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-54171 is a medium vulnerability (CVSS 6.5) in Excon, published July 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in excon 1.5.0.

References

Show 6 moreShow less
This page doesn't list everything

Left out here: 228 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open